CVE-2023-0284 Improper validation of LDAP user IDs

2023-01-2412:03:57

CWE-20

Tribe29

www.cve.org

cve-2023-0284

improper validation

ldap user ids

tribe29 checkmk

input validation

attackers

server files

checkmk 2.1.0p19

checkmk 2.0.0p32

checkmk 1.6.0 eol

CVSS3

6.8

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

33.4%

JSON

Improper Input Validation of LDAP user IDs in Tribe29 Checkmk allows attackers that can control LDAP user IDs to manipulate files on the server. Checkmk <= 2.1.0p19, Checkmk <= 2.0.0p32, and all versions of Checkmk 1.6.0 (EOL) are affected.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Checkmk",
    "vendor": "Tribe29",
    "versions": [
      {
        "lessThanOrEqual": "2.0.0p32",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "2.1.0p19",
        "status": "affected",
        "version": "2.1.0",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "1.6.0p30",
        "status": "affected",
        "version": "1.6.0",
        "versionType": "semver"
      }
    ]
  }
]